slimtoolkit/slim · error

ephemeral container not found

Error message

ephemeral container not found

What it means

After attaching a debug (ephemeral) container to the pod and updating it via the Kubernetes API, the tool re-reads the pod and looks up the ephemeral container by the generated debug container name. If the updated pod does not contain that ephemeral container, the command fails. This usually means the ephemeral container was never actually admitted or attached.

Source

Thrown at pkg/app/master/command/debug/handle_kubernetes_runtime.go:482

		Pods(pod.Namespace).
		Get(ctx, pod.Name, metav1.GetOptions{})
	if err != nil {
		logger.WithError(err).Error("error getting the ephemeral container from target pod")
		xc.FailOn(err)
	}

	logger.WithFields(
		log.Fields{
			"ns":     nsName,
			"pod":    podName,
			"target": commandParams.TargetRef,
			"image":  commandParams.DebugContainerImage,
		}).Debug("attached ephemeral container")

	ec := ephemeralContainerFromPod(updatedPod, commandParams.TargetRef, debugContainerName)
	if ec == nil {
		logger.Errorf("ephemeral container not found in pod")
		xc.FailOn(fmt.Errorf("ephemeral container not found"))
	}

	ecData, _ := json.Marshal(ec)
	logger.WithField("data", string(ecData)).Trace("ephemeral container")

	var ecContainerIsRunning bool
	for _, ecStatus := range updatedPod.Status.EphemeralContainerStatuses {
		if ecStatus.Name == debugContainerName {
			if ecStatus.State.Running != nil {
				ecContainerIsRunning = true
			}
			break
		}
	}

	if !ecContainerIsRunning {
		xc.Out.Info("wait.for.debug.container",
			ovars{

View on GitHub (pinned to 81940d17fa)

Solutions

1. Verify cluster Kubernetes version >= 1.23 (GA) or that the EphemeralContainers feature gate is enabled.
2. Check RBAC: the credentials need 'update' on 'pods/ephemeralcontainers' (`kubectl auth can-i update pods/ephemeralcontainers`).
3. Inspect the pod after the attempt (`kubectl get pod <pod> -o yaml`) to see if the ephemeral container was admitted or rejected and why.
4. Retry with a different --debug-container image that is pullable from the cluster.

Example fix

// before (k8s 1.20, no support)
slim debug pod/myapp --target app
// after: upgrade cluster to >=1.23 or use kubectl debug on a supported cluster
kubectl debug -it myapp --image=busybox --target=app

kubectl version --short  # require server >= 1.23
kubectl auth can-i update pods/ephemeralcontainers --all-namespaces

if err := runDebug(target); err != nil && strings.Contains(err.Error(), "ephemeral container not found") {
    // fall back to `kubectl debug` or node-level debugging
}

When it happens

Trigger: HandleKubernetesRuntime attaches an ephemeral container, calls Update on the pod, then ephemeralContainerFromPod(updatedPod, targetRef, debugContainerName) returns nil because the pod's ephemeralContainerStatuses/spec lack the expected container.

Common situations: Kubernetes API server silently dropped the ephemeral container (feature gate EphemeralContainers disabled, k8s < 1.23 behavior differences); RBAC denies updating pod/ephemeralcontainers so the update fails or is ignored; managed clusters (some managed K8s flavors) restrict ephemeral containers; image pull rejected so the container never appears in statuses.

Related errors

• target container not found
• pod is done
• Pod terminated
• Pod not running
• Container terminated

AI-assisted analysis of slimtoolkit/slim@81940d17fa (2026-08-31). Data as JSON: /api/errors/eccb8d36d985be13. Report an issue: GitHub.